External risk intelligence

Windows RRAS Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-85792

The Windows Routing and Remote Access Service (RRAS) is a network service explicitly designed to provide remote access, VPN, and routing capabilities. Such services are commonly configured as internet-facing edge gateways, making them public-facing by design in many standard deployment configurations.

Use After Free

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Microsoft's Windows Routing and Remote Access Service (RRAS). This issue could allow an attacker to execute unauthorized code on a victim's machine without any user interaction. The nature of RRAS as a network-facing service means this vulnerability warrants attention to determine relevance and exposure within our environment.

Allows remote code execution on Windows servers.
Network-facing service, commonly internet-exposed.
Assess impact and confirm any exposure.

Attack Path

How an attacker could exploit the issue

An attacker could remotely target the Windows Routing and Remote Access Service (RRAS) over the network. By reaching this service, an attacker could potentially gain unauthorized access and execute arbitrary code on a victim's machine.

No privileges needed for attack.
Attack triggers via network access to RRAS.
Risk of unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in the Windows Routing and Remote Access Service (RRAS) could allow an unauthenticated attacker to execute arbitrary code on a victim's machine. This could occur when the RRAS service is exposed to the network and an attacker sends specially crafted requests. Such a compromise could lead to a complete takeover of the affected system.

System access and control.
Unauthenticated network requests.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Windows Routing and Remote Access Service (RRAS) is often deployed as an internet-facing component, making this a critical concern for network and security teams. The first practical step is to identify all instances of RRAS, determine their exposure and business criticality, and confirm ownership before planning remediation.

Network and security teams own this.
Verify RRAS exposure and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows Routing and Remote Access Service (RRAS)?

RRAS is a core Windows server component used to manage network connectivity, including Virtual Private Network (VPN) support and routing traffic between different network segments. It acts as a gateway for remote users to access internal resources, often functioning as a bridge between public and private network environments.

How does CVE-2026-85792 work?

This vulnerability is classified as a use-after-free weakness, identified as CWE-416. It occurs when a program continues to use a memory pointer after that memory has been cleared or freed. In the context of this CVE, sending specially crafted requests to the RRAS service can exploit this memory management flaw to execute unauthorized code.

Do I need to be authenticated to trigger this vulnerability?

No, an attacker does not need to provide any credentials to trigger the bug. The vulnerability is reachable via unauthenticated network requests sent directly to the RRAS service. Simply having network connectivity to the affected service is sufficient to initiate the attack; it does not require user interaction or pre-existing system privileges.

Is my server at risk if it runs RRAS?

Your risk level depends heavily on network placement. According to Halo Surface Signal, RRAS is often intentionally deployed as an internet-facing edge gateway to provide remote access. If your RRAS instance is exposed to the public internet, it faces a higher likelihood of being reachable by remote attackers compared to instances restricted to internal, private networks.

How should I respond to CVE-2026-85792?

Your first step is to inventory your environment to locate all servers running the RRAS role. Once identified, evaluate whether these services are necessary for current business operations and if they are exposed to the internet. Prioritize checking systems that act as public-facing gateways, and ensure you are monitoring vendor update channels for official patches to remediate the service.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85792

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.